Essentially, I'm wondering how difficult or possible it would be to do a core-dump on an already running process that was started without a debugger.
I have a video that I opened in VLC (and is still running in VLC). I accidentally, however, deleted the original file but to my surprise, was still able to scroll back and forth on in VLC (making me think it's still in memory).
Would it somehow be possible to do a core dump of the running process from it's PID and somehow piece together the data? Would that likely involve me following pointers through data-structures that I would need to sift through VLC's source code for?
I'm running OSX right now (so BSD). I think you could do a core-dump on processes with gdb
if it was started alongside the debugger, but I'm not sure about trying to do it with processes already running (as I'm sure the OS would also not like that).
Any ideas?
I would add the tag "core-dump" but I don't have enough points.